I have a server with multiple users which each have multiple authorized SSH keys. Is there any effective way (command line utility?) to keep track of which key belongs to who and to quickly remove/add keys (apart from ssh-copy-id)?
asked Feb 10, 2011 at 1:01
4 Answers
You can use the last part of each lines in .ssh/authorized_keys is intended for comments. From man sshd:
Protocol 1 public keys consist of the following space-separated fields: options, bits, exponent, modulus, comment. Protocol 2 public key consist of: options, keytype, base64-encoded key, comment.
And to answer the question, I use vim but any editor should do it.
My comments usually contains:
- creation date
- physical location: creation computer / USB stick (I prefer not to move private key but generate/revoke them and know where they are)
- 1-2 words about purpose (for which login, for which client, for which script)
answered Feb 16, 2011 at 10:08
I'd checkout the Monkeysphere project. It uses OpenPGP's web of trust concepts to manage ssh's authorized_keys and known_hosts files, without requiring changes to the ssh client or server.
There's also ssh-import-id, which can securely import users' SSH public keys from Launchpad.net.
answered Feb 17, 2012 at 21:22
Bastillion - https://www.bastillion.io
Users manage their own SSH keys based on profiles that have been assigned to them.
.ssh/authorized_keysis intended for comments (fromman sshd: "Protocol 1 public keys consist of the following space-separated fields: options, bits, exponent, modulus, comment. Protocol 2 public key consist of: options, keytype, base64-encoded key, comment."). And to answer the question, I usevimbut any editor should do it.